Loading vulnerability…
CVE-2019-1040 is a Microsoft Windows NTLM tampering vulnerability in which a man-in-the-middle attacker can bypass NTLM Message Integrity Check (MIC) protection during NTLM authentication. By tampering with the NTLM exchange and omitting the MIC while altering NTLM negotiation flags, an attacker can cause vulnerable systems to accept modified authentication data without detecting the manipulation. This weakens NTLM relay protections and enables protocol relay scenarios that would otherwise be blocked by integrity checks, including relaying SMB authentication to LDAP in Active Directory environments.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
4 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository implements the PrintSpoofer exploit as a Reflective DLL in C++. The exploit targets a vulnerability in the Windows Print Spooler service (CVE-2019-1040 / CVE-2019-1019) that allows a local attacker with SE_IMPERSONATE_NAME privilege to escalate to SYSTEM. The main exploit logic is in 'dllmain.cpp' and 'PrintSpoofer.cpp', which create a named pipe, trigger the Print Spooler to connect via RPC, and impersonate the SYSTEM token. Upon success, the exploit executes a specified binary as SYSTEM. The repository includes full source code, IDL definitions for the MS-RPRN protocol, and a Reflective DLL loader for in-memory execution. No network endpoints are targeted; the attack vector is local privilege escalation via named pipes and RPC. The code is operational and suitable for use in penetration testing frameworks such as Cobalt Strike.
This repository is a comprehensive Python-based exploit toolkit targeting CVE-2019-1040, a critical NTLM relay vulnerability affecting Microsoft Windows environments, particularly Exchange servers and Domain Controllers. The main entry point is 'CVE-2019-1040.py', which orchestrates the attack by setting up relay servers for various protocols (SMB, HTTP, LDAP, IMAP, MSSQL, SMTP) using the 'ntlmrelayx' framework. The toolkit leverages the Impacket library to perform NTLM relay attacks, allowing an attacker to intercept and relay authentication attempts to privileged services, potentially leading to remote code execution, credential dumping (NTDS.dit, SAM), privilege escalation (including adding users or computers to Active Directory), and interactive shells. The codebase is modular, with separate components for protocol clients, attack modules, relay servers, and utility functions. The exploit requires the attacker to specify the Exchange server, Domain Controller, and attacker host, and supports various attack options such as dumping only specific user credentials. The repository is operational and provides a flexible platform for post-exploitation activities in Windows Active Directory environments vulnerable to NTLM relay attacks.
This repository contains a single main exploit script, dcpwn.py, and a README. The script is a sophisticated Python exploit targeting Microsoft Windows environments vulnerable to CVE-2019-1040. It leverages the impacket library and several of its modules to perform a multi-stage attack: (1) authenticates to LDAP using provided domain credentials, (2) creates a new machine account if necessary, (3) abuses Resource-Based Constrained Delegation (RBCD) to allow the attacker-controlled account to impersonate privileged users, (4) relays NTLM authentication to obtain a Kerberos ticket for administrator, and (5) uses WMI over SMB to execute arbitrary commands on the target system. The script requires network access to the Domain Controller and the target machine, and interacts with several network services (LDAP, SMB, Kerberos). The exploit is operational and provides a full attack chain from initial access to remote code execution as administrator. The README provides a brief description and credits, but the main logic and attack flow are implemented in dcpwn.py.
This repository is a comprehensive exploit toolkit for CVE-2019-1040, targeting Microsoft Windows Active Directory environments vulnerable to NTLM relay attacks. The main entry point is 'dcpwn.py', which orchestrates the attack by setting up relay servers (primarily SMB and LDAPS) and leveraging the 'printer bug' to trigger authentication attempts from the target. The toolkit integrates and extends Impacket's NTLM relay modules, supporting multiple protocols (SMB, LDAP, LDAPS, HTTP, IMAP, MSSQL, SMTP) for relaying authentication. It automates privilege escalation via Kerberos delegation (S4U2Self/S4U2Proxy), can impersonate users, dump credentials, and execute arbitrary commands or open a shell on the target. The codebase is modular, with submodules for protocol-specific attacks, relay clients, and servers, as well as utilities for ticket handling and host file manipulation. The exploit is operational and can be used to achieve remote code execution and domain privilege escalation in vulnerable environments.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
NTLM MIC bypass vulnerability affecting the NTLM/Netlogon authentication chain.
A referenced relay-related Windows authentication vulnerability (mentioned in the context of NTLM relaying / delegation abuse) used as an example of relay-style attacks relevant to LDAP hardening discussions.
A vulnerability in Microsoft Windows NTLM authentication that allows a man-in-the-middle attacker to bypass the NTLM Message Integrity Check (MIC), potentially leading to credential theft or privilege escalation.
A vulnerability in Microsoft Windows that allows attackers to bypass SMB message signing (MIC), enabling NTLM relay attacks and facilitating privilege escalation or lateral movement in Active Directory environments.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.